added a bunch of applicant permissions tests
added a bunch more permissions tests
added permissions to the api